Recognising and reporting data breaches

A personal data breach is any security incident that affects personal data. This includes information being lost, destroyed, changed without permission, disclosed to the wrong person, accessed without authority, or made unavailable when needed. Breaches can be accidental as well as deliberate and are not limited to cyber attacks.

ICO guidance requires organisations to report certain personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Frontline staff do not need to decide whether a breach must be reported to the ICO, but they must report possible breaches internally straight away.

Examples in care settings

• Lost paperwork: handover sheet, MAR chart copy, hospital letter, care plan, or visitor information left in a public place.
• Wrong disclosure: email, text, letter, voicemail, or printed record sent to the wrong person.
• Unauthorised access: staff opening records out of curiosity, for family reasons, or beyond their role.
• Visible information: screen left unlocked, records visible to visitors, or confidential waste placed in ordinary bins.
• Device or system issue: lost phone, stolen laptop, malware, ransomware, or inability to access care records.
• Photo or messaging incident: resident image or record shared in an unapproved app or on social media.

What to do first

• Do not hide the incident: reporting quickly helps protect residents and the organisation.
• Contain if safe: retrieve paperwork, ask the unintended recipient not to read or share, lock the screen, or report the lost device.
• Tell the right person: senior, manager, nurse in charge, data protection lead, or on-call manager according to policy.
• Record facts: note what happened, when, what information was involved, who may be affected, and what immediate action was taken.
• Do not delete evidence: do not remove messages, alter records, or pressure others to stay silent.

Reportability and 72 hours

If personal information has been compromised, report it quickly. Silence usually increases risk; early action can reduce harm.